Preventing money laundering – What recent cases reveal

Four cases and the same vulnerabilities: What recent money laundering cases reveal about KYC and AMLR readiness

A fine imposed on a Volksbank, conditions imposed on a Landesbank, a crypto network dismantled and smaller market participants facing fines: at first glance, the money laundering headlines of recent months appear very different. On closer inspection, however, one repeatedly comes across the same gaps and a similar use case.

Around 100 billion euros are laundered in Germany every year. This was the estimate put forward by the German Judges’ Association in a press release in December 2025, whilst also lamenting that law enforcement agencies lack both staff and technology. The figure clearly shows that the state alone will not solve the problem. Banks, financial service providers, insurance companies and all other entities subject to the Money Laundering Act form the first line of defence.

Four cases from recent months illustrate just how effective this line of defence is. We have examined them in detail and ask: what went wrong, what lessons can be learnt, and what can be done better?

Case 1: Helaba – when customer data becomes out of date

In July 2026, the Handelsblatt on regulatory measures taken by BaFin against Landesbank Hessen-Thüringen (Helaba).

The regulator criticised the way the bank identifies its customers and keeps their data up to date. It also identified significant shortcomings in risk analysis and transaction monitoring.

Hessische Landesbank must now rectify these shortcomings and report regularly to BaFin on its progress.

The lesson to be learnt: simply ensuring accurate identification during onboarding is not enough. Companies change their structure, beneficial owners change, as do addresses and business models. A customer record that was accurate five years ago may now paint a completely false picture.

Effective KYC therefore requires more: reliable master data and monitoring, carried out regularly and also in response to specific events.

With the new EU Anti-Money Laundering Regulation (AMLR), which will apply directly in all Member States from 10 July 2027, all of this will become even more binding. For the first time, it sets specific maximum time limits for updating customer data. For high-risk customers, this must be done at least once a year; for all others, at least once every five years (simplified due diligence rules are currently being drawn up https://www.amla.europa.eu/amla-invites-stakeholders-sectoral-roundtables-simplified-customer-due-diligence_en). If relevant circumstances change – for example, the sale of shares or a change in management among business customers – the data must be updated regardless of these time limits.

Case 2: Volksbank Düsseldorf Neuss – where ongoing monitoring is lacking

In September 2026, BaFin imposed fines totalling 210,000 euros on Volksbank Düsseldorf Neuss. The allegations: business relationships were not monitored with sufficient continuity; additional information was missing for certain customers; and enhanced due diligence requirements (in future, in accordance with AMLR: EDD) were not implemented. Suspicion reports were in some cases submitted late or not at all.

The lesson to be learnt: Compliance is not a one-off check during onboarding, but an ongoing task. The extent to which a customer must be vetted and, above all, monitored depends on the level of risk they pose. Anti-money laundering legislation distinguishes between three levels in this regard:

• Simplified due diligence (SDD): where the risk is demonstrably low.
• General due diligence (CDD): the standard procedure, involving identification and risk-based monitoring.
• Enhanced due diligence (EDD): in cases of increased risk, for example involving additional information, further checks and approvals.

Crucially, this classification is not set in stone. New findings, such as a hit in sanctions or PEP screening, must lead to a reassessment. And, where in doubt, to stricter measures or enhanced due diligence.

The AMLR will in future prescribe this grading system uniformly across the EU. The Regulation itself sets out when simplified measures are permissible and when enhanced measures are mandatory. This is supplemented by guidelines and technical standards from the new EU Anti-Money Laundering Authority (AMLA). For businesses, this means less leeway in interpretation and higher requirements for a transparently documented risk classification.

Case 3: Europol – when identities become a commodity

In June 2026, Europol reported, amongst other things, the dismantling of the crypto money-laundering service AudiA6.  It is estimated that more than 336 million euros were laundered via this service between 2022 and 2025. The perpetrators used thousands of accounts on crypto exchanges, opened using stolen or purchased identities. Investigators came across over 6,000 KYC records linked to so-called ‘money mule’ accounts.

The lesson to be learnt here is that the problem does not lie in a single check, but in the connections between accounts. A single account often appears unremarkable. It only becomes suspicious once it is clear that the same person, the same address or the same telephone number is behind dozens of accounts.

With large customer bases, this is virtually impossible to achieve with a simple name check. Spelling varies, addresses differ slightly, and identities are deliberately created multiple times. This is where fault-tolerant matching comes in, which merges similar data records even if they do not match exactly (TL Match).

Here, too, the AMLR is tightening the reins. Crypto-asset service providers are explicitly designated as obliged entities, and the requirements for identity verification are being standardised and tightened across the EU. In future, customer verification will also explicitly include checking against targeted financial sanctions.

It must be stated transparently at this point: analysing blockchain transactions requires highly specialised tools that go beyond traditional KYC.

Case 4: Social Lease and a securities firm – when the fundamentals are lacking

On 27 October 2026, BaFin published a notice of a fine of 25,000 euros against Social Lease GmbH. The financial services institution had failed to implement adequate internal safeguards relating to its business and clients. The breach had already been identified in March 2025, and the notice has been legally binding since 1 October 2026.

At the end of August 2026, a securities firm (name not disclosed) – or, more precisely, its management – was targeted. BaFin issued a warning to two managing directors due to serious and persistent shortcomings in the organisation of the business. The main areas affected were risk management and the prevention of money laundering and terrorist financing.

The lesson to be learnt: Under Section 6(1) of the Money Laundering Act, obliged entities must establish internal policies, procedures and controls to manage and mitigate money laundering risks. If these are lacking or insufficient, fines may be imposed, regardless of the entity’s size or business model.

The AMLR transposes these obligations into uniform EU law: internal policies, procedures and controls, as well as the clear responsibility of a member of senior management for compliance with anti-money laundering regulations. In addition, from 2028, the AMLA will directly supervise certain selected financial institutions, namely those operating across borders with a high-risk profile. BaFin remains responsible for all others.

The second case also demonstrates that anti-money laundering is a matter for senior management. The warning was not directed at the institution, but personally at the managing directors. If they continue the conduct in question, BaFin may demand their dismissal and prohibit them from carrying out their duties.

And both cases make it clear that the regulator has long since ceased to focus solely on large banks. Smaller financial service providers, too, must be able to demonstrate that their due diligence obligations are clearly defined and are actually put into practice on a day-to-day basis.

What the cases have in common

However different the four cases may be, at their core they all revolve around the same issues: Do we really know who our customer is? Do we assess their risk correctly, even if circumstances change? Do we identify anomalies in good time and respond to them? And can we subsequently provide evidence of what we have checked and decided?

This gives rise to five building blocks that interlock in an effective compliance process:

1. Identify: Reliably record and verify customers, companies and beneficial owners. Onboarding
2. Assess: Create a risk profile for each customer, based on automated and manually assessed factors. Risk Model
3. Monitoring: Carry out sanctions and PEP checks, as well as follow-up checks, regularly and on an ad hoc basis. Monitoring
4. Respond: Deal with anomalies in a structured manner, initiate further checks and escalate where necessary. Decisions/Overrides
5. Document: Record results, decisions and processing steps in a traceable manner. Document

How the TOLERANT Compliance Suite supports this

The TOLERANT Compliance Suite is structured precisely around these building blocks. It combines screening against sanctions and PEP lists with KYC and KYB checks, a configurable risk classification system and documented case handling.

In practice, this means that automatic screening results and manually assessed risk factors are both taken into account when classifying a customer. You determine which criteria lead to simplified, standard or enhanced due diligence requirements. Suspicious cases are routed to a workflow where they are processed, documented and, if necessary, escalated.

To this end, we offer what TOLERANT has stood for for many years: data quality. With TL Match, you can identify duplicates and similar data records, even where spellings vary. Customer data can thus be checked, standardised and cleaned up. This is the foundation on which any screening can function reliably.

The aim is to reduce manual routine work and ensure consistent processes and controls that will stand up to the next audit by the regulatory authority.

The TL Compliance Suite is suitable for both SMEs and as an enterprise solution; it can be operated as SaaS or as an on-premises licence, and even individual modules can be implemented and integrated into existing system landscapes and processes. The software is multi-client capable and highly configurable – making compliance as straightforward as an organisation needs it to be.

Conclusion: Anti-money laundering begins long before a case of suspicion arises

None of the four scenarios can be resolved with a single audit tool. What works is the combination of factors: accurate customer data, risk-based decisions, ongoing monitoring and clear lines of responsibility.

Software does not replace the professional judgement of compliance officers or statutory reporting obligations. However, it ensures that controls are carried out consistently and that anomalies do not get lost in day-to-day operations.

How well is your anti-money laundering framework set up? Get in touch with us. We’ll show you how the TOLERANT Compliance Suite combines screening, risk classification and case handling into a single process.